For most accounts that offer them, passkeys are safer than passwords. A password is a secret you invent, remember and hand over to a website. A passkey is a cryptographic credential your device creates and guards, and it never leaves your device. That one difference removes weak choices, reuse and most phishing. It does not remove every risk, and passwords will not disappear from your life this year. Here is how the two compare, where passkeys still fall short, and how to move over without locking yourself out.
TL;DR
- Passkeys beat passwords on phishing resistance, breach exposure and convenience, because the secret is never typed or stored on the website's servers.
- A passkey is usually two-factor on its own: your device (something you have) plus a fingerprint, face scan or PIN (something you are or know).
- Passkeys can still fail through stolen devices, hijacked sync accounts or weak recovery routes, so register more than one and secure your recovery options.
- You can usually keep your password while you adopt passkeys. Keep unique, long passwords in a password manager for sites that do not support passkeys yet.
- Phishing sites can still trick you in other ways, so check unfamiliar sites before you create any account on them.
Table of Contents
- What a password is, and why it keeps failing
- What a passkey is and how it works
- Passkeys vs passwords at a glance
- Are passkeys safer than passwords?
- Passkeys vs 2FA: do you still need a second factor?
- Can you still use your password if you have a passkey?
- Where passkeys still fall short
- How to switch to passkeys without locking yourself out
- Passkeys do not tell you whether a site is trustworthy
- Our perspective
- FAQ
- Sources
What a password is, and why it keeps failing
The U.S. National Institute of Standards and Technology defines a password as a memorized or recorded secret, "something you know," and states plainly that passwords are not phishing-resistant. That is the core problem. Anything you can type, you can also type into the wrong place.
Passwords fail in a handful of predictable ways:
- Weak choices. People pick short, familiar strings because they have to remember them.
- Reuse. One leaked password then opens many accounts.
- Server-side exposure. The website holds something that can be checked against your password. If that database is stolen, attackers can try to crack it or reuse what leaks.
- Phishing. A convincing fake login page collects the password and the attacker uses it on the real site.
A password manager fixes the first two, because it generates and remembers long random strings for you. It does not fix the last two. If you want to see how fake login pages are built and how to spot them, our guide to phishing website warning signs walks through the common tells.
What a passkey is and how it works
A passkey is a discoverable WebAuthn/FIDO credential made of a public and private key pair. OWASP's passkey guidance describes the flow: your authenticator keeps the private key, and at sign-in it signs a challenge from the server that is bound to the requesting site. The service checks that signature with the public key it stored when you registered.
Think of it as a lock and key where the website only ever sees the lock. Microsoft's support page says the same thing in plainer terms: the device holds the private key, the service registers the public key, and your device signs a challenge from the service once you unlock it.
Two details matter for everyday safety:
- The credential is tied to one site. Microsoft Learn explains that a passkey registered for one website or app cannot be replayed at a malicious site pretending to be it. Your device simply will not offer the passkey to a lookalike domain.
- You never invent it. MDN notes that because the authenticator generates the passkey, it is not exposed to weak user-chosen values or ordinary guessing attacks.
What signing in looks like
After you register a passkey, you open the site, pick your account or passkey, and approve with a fingerprint, face scan, PIN or screen lock. Google's developer documentation describes this flow and notes that a nearby phone can approve a sign-in on a laptop. Your biometric data stays on your device. There is nothing to type and nothing to remember.
Passkeys vs passwords at a glance
| Password | Passkey | |
|---|---|---|
| What it is | A secret you choose and remember | A key pair your device generates |
| Who holds the secret | You and the website (in some checkable form) | Only your device or credential provider |
| Phishing | Can be typed into a fake site | Bound to the real site, so a fake site gets nothing usable |
| Site breach | Leaked data can expose or help crack it | Server holds only the public key |
| Weak or reused | Common | Not possible, it is generated |
| Second factor | Usually needs an extra step | Typically built in through device unlock |
| Works everywhere | Yes | Not yet |
| Recovery | Reset by email or SMS | Depends on sync, backup keys and the site's process |
Are passkeys safer than passwords?
Yes, in the ways that cause most account takeovers. MDN's security overview frames it well: passkeys remove weak choices, reuse, server-side secret storage and ordinary phishing, but they do not eliminate attacks against devices, authenticators or recovery systems.
There is a nuance on breaches. MDN explains that a passkey server stores only the public key, so a stolen database does not reveal your private key. A caveat applies: an attacker who can write fake credentials into that database may still compromise accounts. Passkeys shrink the damage from a breach. They do not make a badly built site safe.
The risks that remain
OWASP lists the leftover weak points: compromised sessions, insecure recovery, incorrectly associated credential records, application vulnerabilities, and compromised devices, authenticators or sync accounts. In practice, that translates to a few questions you should ask yourself:
- Is my phone or laptop locked with a strong PIN or biometric? Whoever can unlock your device can often use your passkeys.
- Is the account that syncs my passkeys protected well? If your Apple, Google, Microsoft or password manager account is taken over, so are the passkeys inside it.
- How would I get back in if I lost everything? This is where most people get hurt, and we cover it below.
Passkeys vs 2FA: do you still need a second factor?
Often you do not need to add one, because a passkey already contains two. Microsoft describes passkeys as multifactor authentication because use involves possessing the device that holds the passkey plus a biometric or PIN to unlock it. OWASP agrees with a condition: a passkey provides phishing-resistant MFA when the private key is combined with verified local PIN or biometric authorization. A mere touch that proves presence is not enough to count as a second factor.
You can see this in practice. Google's help page says that if your account uses 2-Step Verification, your passkey bypasses the second authentication step, since signing in with it already verifies that you own the device.
So the comparison is not really passkey versus 2FA. It is a passkey versus a password plus a code. The password-plus-code route is stronger than a password alone, but a code typed into a fake page can still be relayed to the real site. A passkey does not have that gap.
Can you still use your password if you have a passkey?
Usually, yes. Google's help page says that when you create a passkey you opt in to a passkey-first experience, but you still have the option to use your password. It also says that adding a passkey does not change or remove the authentication or recovery factors already on your account.
That has two consequences. First, you can try passkeys with no risk of losing access. Second, your old password is still a door into the account, so it still needs to be strong and unique. Policies differ by site, and some services let you remove the password entirely. Check the account security settings of each service before you do.
Where passkeys still fall short
Honest comparisons list the downsides. These are the real ones.
Not every site supports them
You will keep using passwords for years on smaller shops, forums, older banks and government portals. A password manager remains the right tool for those logins.
Syncing is convenient but concentrates risk
The federal Phishing-Resistant Authenticator Playbook distinguishes device-bound passkeys from passkeys synced across devices. It says synced passkeys improve usability but that the assurance of the synchronization system has to be considered. For ordinary consumers, the playbook's perspective is that synced passkeys are generally attractive. Where tighter control matters, device-bound credentials may be preferred.
Google notes that passkeys may be encrypted on-device before synchronization, can be stored in compatible password managers, and can also be used from a nearby phone to sign in on a laptop without syncing the credential to that laptop.
Recovery is the weakest link
OWASP puts it bluntly: an account's security is limited by its weakest recovery route. It recommends another registered passkey, a separately secured single-use recovery code, or a high-assurance identity process suited to the account's risk. It also says email or SMS should not silently bypass stronger controls on high-risk accounts.
If a site lets anyone reset your account with a text message, an attacker can skip your passkey entirely by taking over your phone number. That is a SIM-swap attack, and it is one reason to lock down your mobile account. Our partner-free advice is simple: add a carrier PIN or port-out lock. If you travel and rely on a new eSIM, setting a telco PIN before you fly is a sensible habit that protects the number your recovery codes may depend on.
How to switch to passkeys without locking yourself out
- Start with the accounts that matter most. Email, your phone or Apple/Google/Microsoft account, banking and your password manager. If your email falls, every other reset follows.
- Secure the place passkeys live. Use a strong device PIN, turn on biometrics, and protect your sync account or password manager with its own strong credentials.
- Register more than one. Add a passkey on a second device, or a hardware security key, so losing one phone does not end your access. This is OWASP's own advice.
- Save recovery codes. Store single-use codes offline or in a separately secured spot, not in the same place as the passkey.
- Keep the password, for now. Make it long, random and unique, stored in a password manager.
- Test sign-in from a second device before you rely on it.
- Review recovery settings. Remove or tighten SMS-only reset options where the service lets you.
If you want a wider set of habits around all this, our safe browsing habits checklist and browser safety best practices cover the surrounding basics.
Passkeys do not tell you whether a site is trustworthy
This is the part many comparisons skip. A passkey proves you are talking to the site you registered with. It says nothing about whether that site is honest. If you create an account on a fake store, your passkey will work perfectly for the fake store, and your card details, address and phone number are still in the hands of whoever runs it.
Before you create any account on a site you have not used before, run it through our free website trust checker. Paste the URL, and you get a 0 to 100 trust score built from 200+ signals such as Google Safe Browsing, VirusTotal and WHOIS data, with a clear verdict from dangerous to trusted. No registration is needed. If you are about to pay, our guide on how to verify a payment page before you pay is the next step, and you can browse recently checked websites to see how verdicts look in practice.
Our perspective
We look at sites all day, and the pattern is consistent: the sign-in page is rarely the first thing that goes wrong. The first thing that goes wrong is the decision to trust a site with an account at all. Passkeys are the best improvement to the login step in a long time because they take the most error-prone part, you, out of the loop. A fake page cannot collect what your device refuses to give it.
But we stay slightly skeptical, as you should. A passkey protects the door, not the room behind it. It does not tell you who runs the site, whether the checkout is real, or whether the company will still exist next month. That is why we pair strong authentication with a quick look at a site's ownership, reputation and infrastructure before you hand over anything.
Our practical rules: use passkeys wherever a service you trust offers them, keep a second passkey and a recovery code, keep unique passwords in a manager for everything else, and verify unfamiliar sites first. Our verdicts are independent of any payment, and we do not accept pay-for-a-better-score offers. If you are weighing password managers or VPNs, our list of most trusted VPN and security sites shows how those sites score.
— Nick
FAQ
Are passkeys really safer than passwords?
For most people, yes. A passkey is generated by your device, tied to a specific site, and never stored on the site's server in a usable form, so it resists weak choices, reuse and ordinary phishing. It is not perfect: a stolen unlocked device, a hijacked sync account or a weak recovery process can still lead to takeover.
What are the disadvantages of passkeys?
Support is uneven, so you still need passwords on many sites. Recovery can be confusing if you lose a device without a backup passkey or recovery code. Synced passkeys also make your sync account a high-value target, so it needs strong protection.
Should I use a passkey instead of a password?
Where a service you trust offers one, generally yes, and keep a password as a fallback if the site still allows it. Register passkeys on more than one device and keep recovery codes safe. For sites without passkey support, a long unique password in a password manager is still the right choice.
Do I need two-factor authentication if I use a passkey?
Usually not as an extra step, because a passkey combines your device with a fingerprint, face scan or PIN. Some services still ask for a code if they have not built the passkey flow to require local verification. Follow the account's own security settings and keep two-factor on for the password that remains on the account.
Sources
- NIST Digital Identity Guidelines, SP 800-63B-4
- OWASP Passkey Security Cheat Sheet
- OWASP Multifactor Authentication Cheat Sheet
- Microsoft Support: Passkeys FAQ
- Microsoft Learn: Passkeys (FIDO2) authentication method
- MDN: Passkeys security
- Google for Developers: Passkeys
- Google Account Help: Sign in with a passkey instead of a password
- IDManagement.gov: Phishing-Resistant Authenticator Playbook